CVE-2021-25320 — Rancher: Cloud credentials can be used through proxy API by users without access

CVE-2021-25320

Rancher: Cloud credentials can be used through proxy API by users without access PUBLISHED

Description (CNA)

A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by creating requests with the cloud-credential ID. Rancher in this case would attach the requested credentials without further checks This issue affects: Rancher versions prior to 2.5.9; Rancher versions prior to 2.4.16.

Affected (CNA)

Vendor / product	Versions
Rancher / Rancher	affected Rancher before 2.5.9
Rancher / Rancher	affected Rancher before 2.4.16

CWE

CWE-284

References

https://bugzilla.suse.com/show_bug.cgi?id=1185514

ADP enrichment

CVE

No English description supplied.

https://bugzilla.suse.com/show_bug.cgi?id=1185514